Privacy Policy

Solidhouse Builders and Construction Inc., doing business as “Viro Homes” (“Viro Homes,” “we,” “us,” or “our”), is a design-build-furnish modular home company organised and existing under the laws of the Republic of the Philippines. We operate this website, our online furniture store, customer accounts, articles, live chat, appointment scheduling, and related services (together, the “Services”).

For the personal information we process through the Services, we are the Personal Information Controller responsible for deciding how and why your data is processed under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (“NPC”).

• Registered office — Unit 1803/1804, Capital House, Tower 1, 9th Ave. Cor. 34th St., Bonifacio Global City, Taguig, 1634, Philippines.
• Privacy enquiries and Data Protection Officer — info@virohomes.com (attention: Data Protection Officer).
• Telephone — +63 917 721 8300.

This policy covers personal information we process when you:

• browse our website and articles;
• create and use a customer account;
• shop in, and place orders through, our online furniture store;
• contact us through live chat, email, contact forms, or our other channels; or
• book a consultation or appointment with us.

Our modular home projects are governed by separate written agreements; this policy still applies to any personal information you give us through the Services. This policy does not cover third-party websites or services we link to, which have their own privacy policies.

We collect only the personal information we need for the purposes described in this policy:

• Account and identity data — the email address you use to register and sign in, your name or display name, and your mobile number. Our customer accounts are passwordless: we email you a one-time verification code rather than storing a password.
• Business and tax data — for business accounts, your business name, Tax Identification Number (TIN), and tax jurisdiction, used to issue valid invoices and official receipts.
• Delivery and address data — recipient name, contact number, address lines, barangay, city, province or region, postal code, country, and, for furniture deliveries, map-pin coordinates (latitude and longitude), used to quote and arrange delivery.
• Order and transaction data — the products you buy, quantities, order history and reference numbers, billing and shipping details, invoices, and saved items in your wishlist or cart.
• Communications — the content of your messages to us through live chat, email, contact forms, and appointment bookings, and our replies.
• Usage and device data — pages and products viewed, referring pages, approximate location derived from your IP address, and your browser, device, operating system, and language preferences, collected through cookies and similar technologies subject to your consent. See our Cookie Policy for the analytics and functional tools we use.
• Security and sign-in logs — for each sign-in attempt, successful or failed, we record the IP address, browser or user-agent, date and time, authentication method, and the email address entered, to protect accounts and detect and investigate fraud and unauthorised access.

Payment data. Payments are processed by our PCI-DSS-compliant third-party payment provider (Xendit). We receive the payment status, the payment method type (for example card, GCash, or Maya), a transaction reference, and the amount. We do not collect, see, or store your full card number, expiry, or CVV — that information is handled directly by the payment provider within its secure environment.

Information from third parties. We receive limited information from our service providers, such as payment confirmations from our payment processor, delivery status from our logistics partners, and aggregated measurement data from our analytics providers.

Sensitive information and children. We do not seek to collect sensitive personal information (such as health, religious, or political data); please do not send us such information unless we specifically request it. Our Services are intended for adults aged 18 and over, and we do not knowingly collect personal information from children.

We use your personal information to:

• create, verify, and manage your account, and authenticate your sign-in;
• process, fulfil, and deliver your orders, and handle cancellations, returns, and refunds;
• issue invoices and official receipts and meet tax and accounting obligations;
• respond to your enquiries, schedule consultations, and provide customer support;
• operate, secure, maintain, and improve the Services, including measuring performance and detecting and preventing fraud, abuse, and security incidents;
• send you transactional messages such as verification codes, order confirmations, invoices, and payment or refund notices;
• send marketing updates where you have opted in, which you may withdraw at any time; and
• comply with our legal obligations and enforce our Terms & Conditions.

Under Sections 12 and 13 of the Data Privacy Act, we process personal information on one or more of the following bases:

• Performance of a contract — to create your account, process and deliver your orders, and provide the Services you request;
• Consent — for non-essential analytics and functional cookies and for marketing communications, which you may withdraw at any time;
• Legal obligation — to comply with tax, accounting, consumer-protection, and record-keeping requirements; and
• Legitimate interests and our functions as an organisation — to secure and improve the Services, prevent fraud, and run our business, balanced against your rights and freedoms.

We do not sell your personal information. We share it only with service providers (personal information processors) who help us run the Services, and only to the extent necessary. Each processor is bound by a data processing agreement and may use your data only on our instructions. Our current categories of processors are:

• Payment processing (Xendit) — to securely accept payments;
• Delivery and logistics (Lalamove and accredited couriers) — to dispatch and deliver your orders within the Philippines;
• Transactional email (Resend) — to send verification, order, invoice, and account emails;
• Hosting, storage, and content delivery (Google Cloud Platform, Vercel, and Bunny.net) — to host the site, its database, and serve media;
• Analytics and reliability (Google Analytics 4, Microsoft Clarity, Vercel Analytics and Speed Insights, and Sentry) — to measure usage and keep the site stable;
• Address and city look-up (Google Maps Platform for delivery addresses in the furniture store, and Photon / OpenStreetMap for city-only look-ups in our enquiry and brochure forms) — to help you enter a location; and
• Live chat and scheduling (Tawk.to and Cal.com) — to power messaging and appointment booking when you choose to use them.

The specific analytics and functional providers, with links to each provider, are listed in our Cookie Policy. We may also disclose personal information where required to comply with law, a lawful court or regulatory order, or to establish, exercise, or defend legal claims, and to protect the rights, property, and safety of Viro Homes, our customers, and the public. If we are involved in a merger, acquisition, or asset sale, your information may be transferred subject to this policy.

Some of our processors are located outside the Philippines. Where personal information is transferred abroad, we remain accountable for its protection and put appropriate safeguards in place, such as contractual data-protection commitments, consistent with the Data Privacy Act and NPC guidance.

We keep personal information only for as long as necessary for the purposes described in this policy, after which we securely delete or anonymise it. Our indicative retention periods are:

• Order, invoice, and accounting records — at least ten (10) years, as required by the Bureau of Internal Revenue under the National Internal Revenue Code, as amended, and Revenue Regulations No. 17-2013;
• Account profile data — for as long as your account is active, then up to twenty-four (24) months after closure or prolonged inactivity, unless a longer period is required by law;
• Sign-in and security audit logs — up to twenty-four (24) months;
• One-time verification codes — valid for ten (10) minutes, then expired and unusable;
• Session refresh tokens — up to thirty (30) days, then expired or revoked;
• Cookie-consent record — up to twelve (12) months, after which we ask you again; and
• Live chat and support communications — up to twenty-four (24) months.

We apply organisational, technical, and physical safeguards appropriate to the risk, including:

• encryption of data in transit;
• passwordless customer sign-in using one-time codes, reducing the risk of reused or stolen passwords;
• authentication safeguards for staff access, including multi-factor authentication and secure credential storage;
• short-lived, revocable sign-in sessions, together with rate-limiting and lockout controls on authentication;
• access logging and role-based access control on a least-privilege basis, so staff can access only the data their role requires;
• no storage of full card data — card processing is delegated to a PCI-DSS-compliant payment provider; and
• use of reputable cloud hosting, storage, and email providers.

No method of transmission or storage is completely secure, so while we work hard to protect your information, we cannot guarantee absolute security.

Subject to the conditions and exceptions in the law, you have the right to be informed, to access, to object, to rectify, to erase or block, to data portability, to be indemnified for damage caused by unlawful processing, and to lodge a complaint with the National Privacy Commission.

To exercise any of these rights, contact us at info@virohomes.com. We may need to verify your identity first, and we aim to respond within the timeframes required by law. You can also manage some details directly in your account and update your cookie choices at any time through the Cookie settings link in our footer. You may also file a complaint with the National Privacy Commission (privacy.gov.ph).

You may ask us to close your account and delete your personal data. We will do so, except where we are required or permitted by law to retain certain records — for example, order and invoice records retained for tax purposes. Where data must be retained, we restrict its use to those legal purposes.

We maintain procedures to detect, assess, and respond to personal data breaches. Where a breach requires notification, we will notify the National Privacy Commission and affected individuals as, and within the timeframes, required under the Data Privacy Act and applicable National Privacy Commission issuances, and we will take steps to mitigate its effects.

We may update this Privacy Policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, notify you. Your continued use of the Services after changes take effect means you accept the updated policy.

For any privacy question or request, contact our Data Protection Officer at info@virohomes.com or write to Solidhouse Builders and Construction Inc. (Viro Homes), Unit 1803/1804, Capital House, Tower 1, 9th Ave. Cor. 34th St., Bonifacio Global City, Taguig, 1634, Philippines.